dsh-plugin-shop 0.4.8 → 0.4.10

package/lib/index.js

@@ -1,12 +1,12 @@
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { loadOptionalPatches, readProfileManifest, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
 import { lt, minVersion, valid } from "semver";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { basename, dirname, join } from "node:path";
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { z } from "zod";
-import { spawn } from "node:child_process";
 import { dump } from "js-yaml";
 //#region src/own-version.ts
 /** The shop's own published version, read from the package.json that ships
@@ -37,7 +37,8 @@ const entrySchema = z.object({
 	]),
 	metadata: z.enum(["declared", "derived"]),
 	review: z.object({
-		reviewedVersion: z.string(),
+		reviewedVersion: z.string().optional(),
+		reviewedCommit: z.string().optional(),
 		reviewer: z.string(),
 		reviewCommit: z.string(),
 		notes: z.string()
@@ -56,7 +57,9 @@ const entrySchema = z.object({
 			zh: z.string().optional()
 		}),
 		capabilities: z.array(z.string())
-	}).optional()
+	}).optional(),
+	source: z.enum(["npm", "github"]).default("npm"),
+	repo: z.string().optional()
 });
 const dataSchema = z.object({
 	schemaVersion: z.number(),
@@ -140,13 +143,13 @@ async function loadCatalog(options) {
 	const readCached = () => {
 		try {
 			const pointer = pointerSchema.parse(JSON.parse(fsImpl.read(indexPath)));
-			if (pointer.schemaVersion > 2) throw new Error(`catalog schemaVersion ${pointer.schemaVersion} is newer than this build supports (2)`);
+			if (pointer.schemaVersion > 3) throw new Error(`catalog schemaVersion ${pointer.schemaVersion} is newer than this build supports (3)`);
 			const dataPath = join(cacheDir, basename(pointer.plugins.url));
 			const dataText = fsImpl.read(dataPath);
 			const actual = createHash("sha256").update(dataText).digest("hex");
 			if (actual !== pointer.plugins.sha256) throw new Error(`cached catalog data failed integrity check: expected ${pointer.plugins.sha256}, got ${actual}`);
 			const data = dataSchema.parse(JSON.parse(dataText));
-			if (data.schemaVersion > 2) throw new Error(`catalog schemaVersion ${data.schemaVersion} is newer than this build supports (2)`);
+			if (data.schemaVersion > 3) throw new Error(`catalog schemaVersion ${data.schemaVersion} is newer than this build supports (3)`);
 			let stars = {};
 			if (pointer.stars !== void 0) try {
 				const starsText = fsImpl.read(join(cacheDir, basename(pointer.stars.url)));
@@ -187,7 +190,7 @@ async function loadCatalog(options) {
 		throw error;
 	}
 	const pointer = pointerSchema.parse(JSON.parse(pointerText));
-	if (pointer.schemaVersion > 2) throw new Error(`catalog schemaVersion ${pointer.schemaVersion} is newer than this build supports (2)`);
+	if (pointer.schemaVersion > 3) throw new Error(`catalog schemaVersion ${pointer.schemaVersion} is newer than this build supports (3)`);
 	const dataUrl = resolveDataUrl(baseUrl, pointer.plugins.url);
 	let dataText;
 	try {
@@ -205,7 +208,7 @@ async function loadCatalog(options) {
 	const actual = createHash("sha256").update(dataText).digest("hex");
 	if (actual !== pointer.plugins.sha256) throw new Error(`catalog data failed integrity check: expected ${pointer.plugins.sha256}, got ${actual}`);
 	const data = dataSchema.parse(JSON.parse(dataText));
-	if (data.schemaVersion > 2) throw new Error(`catalog schemaVersion ${data.schemaVersion} is newer than this build supports (2)`);
+	if (data.schemaVersion > 3) throw new Error(`catalog schemaVersion ${data.schemaVersion} is newer than this build supports (3)`);
 	let stars = {};
 	if (pointer.stars !== void 0) try {
 		const starsResponse = await fetchImpl(resolveDataUrl(baseUrl, pointer.stars.url));
@@ -497,6 +500,25 @@ async function fetchLatestVersion(fetchFn = fetch) {
 	}
 }
 //#endregion
+//#region src/host/repo-pins.ts
+/** Read the pins file; any irregularity degrades to an empty record. */
+function readRepoPins(fs, path) {
+	if (!fs.exists(path)) return {};
+	try {
+		const parsed = JSON.parse(fs.read(path));
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return {};
+		const out = {};
+		for (const [name, commit] of Object.entries(parsed)) if (typeof commit === "string" && /^[0-9a-f]{40}$/.test(commit)) out[name] = commit;
+		return out;
+	} catch {
+		return {};
+	}
+}
+/** Write the pins file atomically enough for its purpose (a cache). */
+function writeRepoPins(fs, path, pins) {
+	fs.write(path, `${JSON.stringify(pins, null, 2)}\n`);
+}
+//#endregion
 //#region src/host/profile.ts
 /** Profile directory discovery and user-layer writes (§8: hot enable/disable). */
 /**
@@ -759,6 +781,8 @@ let ShopGateway = (() => {
 		restartExitDelayMs;
 		restartParentPid;
 		latestVersion;
+		hasGit;
+		pinFs;
 		/** The install gate runs against the last loaded snapshot, never a fresh
 		* fetch per request (§7.2: the Host's cached snapshot is the truth). */
 		/** Finished install records retained, so a poll sees the true terminal
@@ -786,6 +810,19 @@ let ShopGateway = (() => {
 			this.restartExitDelayMs = options.restartExitDelayMs ?? ShopGateway.RESTART_EXIT_DELAY_MS;
 			this.restartParentPid = options.restartParentPid ?? process.pid;
 			this.latestVersion = options.fetchLatestVersion ?? (() => fetchLatestVersion());
+			this.hasGit = options.hasGit ?? (() => spawnSync("git", ["--version"], { stdio: "ignore" }).status === 0);
+			this.pinFs = options.pinFs ?? {
+				exists: (path) => existsSync(path),
+				read: (path) => readFileSync(path, "utf8"),
+				write: (path, data) => {
+					mkdirSync(dirname(path), { recursive: true });
+					writeFileSync(path, data);
+				}
+			};
+		}
+		/** The pins file lives in the shop's own cache, next to the catalog cache. */
+		pinsPath() {
+			return join(this.rowConfig().cacheDir, "github-pins.json");
 		}
 		/** The boot's Loader root directory (the active profile's `cordis.yml`
 		* directory, carried on `ctx.baseUrl`), when present. A `link:` install
@@ -882,12 +919,39 @@ let ShopGateway = (() => {
 				code: verdict.code,
 				detail: verdict.detail
 			};
+			const entry = this.lastSnapshot.entries.find((e) => e.name === args.name);
+			if (entry === void 0) return {
+				ok: false,
+				code: "not-in-catalog",
+				detail: `dsh-plugin-shop: ${args.name} is not in the catalog`
+			};
+			let spec;
+			if (entry.source === "github") {
+				if (entry.repo === void 0 || !/^[0-9a-f]{40}$/.test(args.version)) return {
+					ok: false,
+					code: "version-mismatch",
+					detail: `dsh-plugin-shop: ${args.name} has no installable commit`
+				};
+				if (!this.hasGit()) return {
+					ok: false,
+					code: "git-missing",
+					detail: "dsh-plugin-shop: git is not on PATH, which github installs require; install git and retry"
+				};
+				spec = `github:${entry.repo}#${args.version}`;
+			} else spec = `${args.name}@${args.version}`;
 			const running = startInstall({
 				profile: this.profile,
-				spec: `${args.name}@${args.version}`,
+				spec,
 				dshBin: this.dshBin,
 				expectedName: args.name
 			});
+			if (entry.source === "github") {
+				const pins = readRepoPins(this.pinFs, this.pinsPath());
+				writeRepoPins(this.pinFs, this.pinsPath(), {
+					...pins,
+					[args.name]: args.version
+				});
+			}
 			this.installs.set(running.installId, running);
 			this.installOrder.push(running.installId);
 			this.evictFinishedInstalls();
@@ -936,11 +1000,20 @@ let ShopGateway = (() => {
 				this.lastSnapshot = snapshot;
 			}
 			const dependencies = readProfileManifest("dsh-plugin-shop", this.profileDirResolved()).dependencies ?? {};
+			const pins = readRepoPins(this.pinFs, this.pinsPath());
 			const installed = [];
 			for (const entry of this.lastSnapshot.entries) {
 				const spec = dependencies[entry.name];
 				if (spec === void 0) continue;
-				installed.push({
+				if (entry.source === "github") {
+					const pin = pins[entry.name];
+					installed.push({
+						name: entry.name,
+						installed: pin ?? spec,
+						latest: entry.version,
+						outdated: pin !== void 0 && pin !== entry.version
+					});
+				} else installed.push({
 					name: entry.name,
 					installed: spec,
 					latest: entry.version,
@@ -992,6 +1065,11 @@ let ShopGateway = (() => {
 				dshBin: this.dshBin,
 				expectedName: args.name
 			});
+			const pins = readRepoPins(this.pinFs, this.pinsPath());
+			if (pins[args.name] !== void 0) {
+				delete pins[args.name];
+				writeRepoPins(this.pinFs, this.pinsPath(), pins);
+			}
 			this.installs.set(running.installId, running);
 			this.installOrder.push(running.installId);
 			this.evictFinishedInstalls();

package/lib/typert.host.js

@@ -18,7 +18,8 @@ const dsh_plugin_shop_shop_catalog_result$schema = z.object({
   'tier': z.union([z.literal("verified"), z.literal("verified-stale"), z.literal("community")]),
   'metadata': z.union([z.literal("declared"), z.literal("derived")]),
   'review': z.union([z.undefined(), z.object({
-  'reviewedVersion': z.string(),
+  'reviewedVersion': z.union([z.undefined(), z.string()]).optional(),
+  'reviewedCommit': z.union([z.undefined(), z.string()]).optional(),
   'reviewer': z.string(),
   'reviewCommit': z.string(),
   'notes': z.string(),
@@ -31,6 +32,8 @@ const dsh_plugin_shop_shop_catalog_result$schema = z.object({
 }),
   'capabilities': z.array(z.string()),
 })]).optional(),
+  'source': z.union([z.literal("npm"), z.literal("github")]),
+  'repo': z.union([z.undefined(), z.string()]).optional(),
 })),
   'denied': z.array(z.object({
   'name': z.string(),
@@ -54,7 +57,7 @@ const dsh_plugin_shop_shop_installStart_result$schema = z.union([z.object({
   'installId': z.string(),
 }), z.object({
   'ok': z.literal(false),
-  'code': z.union([z.literal("not-in-catalog"), z.literal("denied"), z.literal("version-mismatch"), z.literal("needs-acknowledgement")]),
+  'code': z.union([z.literal("not-in-catalog"), z.literal("denied"), z.literal("version-mismatch"), z.literal("needs-acknowledgement"), z.literal("git-missing")]),
   'detail': z.string(),
 })])
 const dsh_plugin_shop_shop_installStatus_parameter_0$schema = z.object({
@@ -137,7 +140,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopCatalogResult',
         schema: dsh_plugin_shop_shop_catalog_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":244,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":270,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installed',
@@ -152,7 +155,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop#shop/installed:result',
         schema: dsh_plugin_shop_shop_installed_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":319,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":374,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStart',
@@ -178,7 +181,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallResult',
         schema: dsh_plugin_shop_shop_installStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":270,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":296,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStatus',
@@ -203,7 +206,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallStatusResult',
         schema: dsh_plugin_shop_shop_installStatus_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":308,"column":3},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":363,"column":3},
     },
     {
       id: 'dsh-plugin-shop#shop/restart',
@@ -218,7 +221,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopRestartResult',
         schema: dsh_plugin_shop_shop_restart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":392,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":469,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/setEnabled',
@@ -243,7 +246,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopSetEnabledResult',
         schema: dsh_plugin_shop_shop_setEnabled_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":213,"column":3},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":239,"column":3},
     },
     {
       id: 'dsh-plugin-shop#shop/uninstallStart',
@@ -269,7 +272,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopUninstallResult',
         schema: dsh_plugin_shop_shop_uninstallStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":359,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":429,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/updateStart',
@@ -294,7 +297,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopUpdateResult',
         schema: dsh_plugin_shop_shop_updateStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":441,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":518,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/version',
@@ -309,7 +312,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopVersionResult',
         schema: dsh_plugin_shop_shop_version_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":426,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":503,"column":9},
     },
   ],
   model: {
@@ -395,7 +398,7 @@ export const TYPERT = {
         "types": [
           {
             "name": "CatalogEntry",
-            "declaration": "export interface CatalogEntry {\n    name: string;\n    version: string;\n    integrity: string | null;\n    publishedAt: string | null;\n    repository: string | null;\n    license: string | null;\n    tier: 'verified' | 'verified-stale' | 'community';\n    metadata: 'declared' | 'derived';\n    review?: { reviewedVersion: string; reviewer: string; reviewCommit: string; notes: string; };\n    catalog?: CatalogSection;\n}"
+            "declaration": "export interface CatalogEntry {\n    name: string;\n    version: string;\n    integrity: string | null;\n    publishedAt: string | null;\n    repository: string | null;\n    license: string | null;\n    tier: 'verified' | 'verified-stale' | 'community';\n    metadata: 'declared' | 'derived';\n    review?: { reviewedVersion?: string; reviewedCommit?: string; reviewer: string; reviewCommit: string; notes: string; };\n    catalog?: CatalogSection;\n    source: 'npm' | 'github';\n    repo?: string;\n}"
           },
           {
             "name": "CatalogSection",
@@ -415,7 +418,7 @@ export const TYPERT = {
           },
           {
             "name": "InstallRejectionCode",
-            "declaration": "export type InstallRejectionCode = 'not-in-catalog' | 'denied' | 'version-mismatch' | 'needs-acknowledgement';"
+            "declaration": "export type InstallRejectionCode = 'not-in-catalog' | 'denied' | 'version-mismatch' | 'needs-acknowledgement' | 'git-missing';"
           },
           {
             "name": "InstallState",

package/lib/typert.remote-client.js

@@ -18,7 +18,8 @@ const dsh_plugin_shop_shop_catalog_result$schema = z.object({
   'tier': z.union([z.literal("verified"), z.literal("verified-stale"), z.literal("community")]),
   'metadata': z.union([z.literal("declared"), z.literal("derived")]),
   'review': z.union([z.undefined(), z.object({
-  'reviewedVersion': z.string(),
+  'reviewedVersion': z.union([z.undefined(), z.string()]).optional(),
+  'reviewedCommit': z.union([z.undefined(), z.string()]).optional(),
   'reviewer': z.string(),
   'reviewCommit': z.string(),
   'notes': z.string(),
@@ -31,6 +32,8 @@ const dsh_plugin_shop_shop_catalog_result$schema = z.object({
 }),
   'capabilities': z.array(z.string()),
 })]).optional(),
+  'source': z.union([z.literal("npm"), z.literal("github")]),
+  'repo': z.union([z.undefined(), z.string()]).optional(),
 })),
   'denied': z.array(z.object({
   'name': z.string(),
@@ -54,7 +57,7 @@ const dsh_plugin_shop_shop_installStart_result$schema = z.union([z.object({
   'installId': z.string(),
 }), z.object({
   'ok': z.literal(false),
-  'code': z.union([z.literal("not-in-catalog"), z.literal("denied"), z.literal("version-mismatch"), z.literal("needs-acknowledgement")]),
+  'code': z.union([z.literal("not-in-catalog"), z.literal("denied"), z.literal("version-mismatch"), z.literal("needs-acknowledgement"), z.literal("git-missing")]),
   'detail': z.string(),
 })])
 const dsh_plugin_shop_shop_installStatus_parameter_0$schema = z.object({
@@ -134,7 +137,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopCatalogResult',
         schema: dsh_plugin_shop_shop_catalog_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":244,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":270,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installed',
@@ -149,7 +152,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop#shop/installed:result',
         schema: dsh_plugin_shop_shop_installed_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":319,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":374,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStart',
@@ -175,7 +178,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallResult',
         schema: dsh_plugin_shop_shop_installStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":270,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":296,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStatus',
@@ -200,7 +203,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallStatusResult',
         schema: dsh_plugin_shop_shop_installStatus_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":308,"column":3},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":363,"column":3},
     },
     {
       id: 'dsh-plugin-shop#shop/restart',
@@ -215,7 +218,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopRestartResult',
         schema: dsh_plugin_shop_shop_restart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":392,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":469,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/setEnabled',
@@ -240,7 +243,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopSetEnabledResult',
         schema: dsh_plugin_shop_shop_setEnabled_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":213,"column":3},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":239,"column":3},
     },
     {
       id: 'dsh-plugin-shop#shop/uninstallStart',
@@ -266,7 +269,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopUninstallResult',
         schema: dsh_plugin_shop_shop_uninstallStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":359,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":429,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/updateStart',
@@ -291,7 +294,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopUpdateResult',
         schema: dsh_plugin_shop_shop_updateStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":441,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":518,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/version',
@@ -306,7 +309,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopVersionResult',
         schema: dsh_plugin_shop_shop_version_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":426,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":503,"column":9},
     },
   ],
 }

package/lib/types/client/locales.d.ts

@@ -44,6 +44,8 @@ export declare const zh: {
     notInCatalogCode: string;
     versionMismatchCode: string;
     needsAcknowledgementCode: string;
+    gitMissingCode: string;
+    githubSource: string;
     installedSection: string;
     installedVersion: string;
     latestVersion: string;
@@ -65,6 +67,7 @@ export declare const zh: {
     updateTransportFailed: string;
     checkUpdate: string;
     upToDate: string;
+    github: string;
     enabledSwitch: string;
     toggleFailed: string;
     hotApplyNote: string;
@@ -116,6 +119,8 @@ export declare const en: {
     notInCatalogCode: string;
     versionMismatchCode: string;
     needsAcknowledgementCode: string;
+    gitMissingCode: string;
+    githubSource: string;
     installedSection: string;
     installedVersion: string;
     latestVersion: string;
@@ -137,6 +142,7 @@ export declare const en: {
     updateTransportFailed: string;
     checkUpdate: string;
     upToDate: string;
+    github: string;
     enabledSwitch: string;
     toggleFailed: string;
     hotApplyNote: string;

package/lib/types/client/present.d.ts

@@ -17,6 +17,11 @@ export declare const ACKNOWLEDGEMENT_ZH = "\u5B89\u88C5\u540E\uFF0C\u6B64\u63D2\
 /** Install rejection code → locale key, for the rejected-state code label
  * (§7.2): every rejection the host can return has a human label here. */
 export declare function rejectionCodeKey(code: InstallRejectionCode): ShopLocaleKey;
+/** The version a card displays: full for npm, the short commit for github. */
+export declare function displayVersion(entry: {
+    source: 'npm' | 'github';
+    version: string;
+}): string;
 /** One polled install status (§7.3 wire data), structural. */
 export interface InstallStatusShape {
     found: boolean;

package/lib/types/host/catalog.d.ts

@@ -1,7 +1,8 @@
 /** Catalog fetch, verification, and disk cache — the Host's only network path. */
 import type { CatalogEntry, DeniedEntry } from './types.ts';
-/** Highest schemaVersion this build understands; a higher one is refused (§10). */
-export declare const SUPPORTED_SCHEMA_VERSION = 2;
+/** Highest schemaVersion this build understands; a higher one is refused (§10).
+ * 3 adds `source` and repo entries (github install channel). */
+export declare const SUPPORTED_SCHEMA_VERSION = 3;
 export interface CatalogSnapshot {
     schemaVersion: number;
     builtAt: string;

package/lib/types/host/index.d.ts

@@ -6,6 +6,7 @@ import type { CatalogEntry, DeniedEntry } from './types.ts';
 import { type InstallArgs, type InstallRejectionCode } from './install.ts';
 import { type InstallStatus } from './executor.ts';
 import { type RestartOutcome } from './restart.ts';
+import { type RepoPinFs } from './repo-pins.ts';
 export type { InstallArgs, InstallRejectionCode } from './install.ts';
 export type { CatalogEntry } from './types.ts';
 /** One Loader inventory entry, structurally — the shop never depends on
@@ -46,6 +47,11 @@ export interface ShopGatewayOptions {
     /** How long the gateway waits after a successful restart response before
      * exiting the old process; test-only shortening, production uses 2s. */
     restartExitDelayMs?: number;
+    /** Whether `git` is on PATH — a github entry cannot install without it;
+     * test-only injection, production probes the real binary. */
+    hasGit?: () => boolean;
+    /** Test-only injection: the pins file's filesystem; production uses node:fs. */
+    pinFs?: RepoPinFs;
 }
 /** `shop/installStart` result (§7.3): rejections are typed wire values with an
  * author-readable `detail`, not thrown RPC errors. */
@@ -138,6 +144,8 @@ export declare class ShopGateway extends TypertRemoteService {
     private readonly restartExitDelayMs;
     private readonly restartParentPid;
     private readonly latestVersion;
+    private readonly hasGit;
+    private readonly pinFs;
     /** The install gate runs against the last loaded snapshot, never a fresh
      * fetch per request (§7.2: the Host's cached snapshot is the truth). */
     /** Finished install records retained, so a poll sees the true terminal
@@ -154,6 +162,8 @@ export declare class ShopGateway extends TypertRemoteService {
     /** Every install id in insertion order, oldest first; finished-record eviction walks this from the front. */
     private readonly installOrder;
     constructor(ctx: Context, options?: ShopGatewayOptions);
+    /** The pins file lives in the shop's own cache, next to the catalog cache. */
+    private pinsPath;
     /** The boot's Loader root directory (the active profile's `cordis.yml`
      * directory, carried on `ctx.baseUrl`), when present. A `link:` install
      * keeps this package at its source location, so the walk-up from

package/lib/types/host/install.d.ts

@@ -1,6 +1,6 @@
 /** Install gate: the four rejection paths of §7.2, as a pure function. */
 import type { CatalogSnapshot } from './catalog.ts';
-export type InstallRejectionCode = 'not-in-catalog' | 'denied' | 'version-mismatch' | 'needs-acknowledgement';
+export type InstallRejectionCode = 'not-in-catalog' | 'denied' | 'version-mismatch' | 'needs-acknowledgement' | 'git-missing';
 export interface InstallArgs {
     name: string;
     version: string;

package/lib/types/host/repo-pins.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The Host's memory of which commit it installed for each github entry.
+ *
+ * pnpm writes the manifest dependency as `github:owner/slug` — no commit —
+ * and the resolved commit lives only in the lockfile. The shop records the
+ * commit it pinned at install time in its own cache so `installed()` can
+ * report `outdated` honestly without parsing pnpm's lockfile. The profile
+ * manifest remains the source of truth for *presence*: a pin whose bundle
+ * is not a manifest dependency is a leftover from a failed install and is
+ * never reported.
+ */
+export interface RepoPinFs {
+    exists: (path: string) => boolean;
+    read: (path: string) => string;
+    write: (path: string, data: string) => void;
+}
+/** Bundle name to the pinned commit. */
+export type RepoPins = Record<string, string>;
+/** Read the pins file; any irregularity degrades to an empty record. */
+export declare function readRepoPins(fs: RepoPinFs, path: string): RepoPins;
+/** Write the pins file atomically enough for its purpose (a cache). */
+export declare function writeRepoPins(fs: RepoPinFs, path: string, pins: RepoPins): void;

package/lib/types/host/types.d.ts

@@ -18,12 +18,17 @@ export interface CatalogEntry {
     tier: 'verified' | 'verified-stale' | 'community';
     metadata: 'declared' | 'derived';
     review?: {
-        reviewedVersion: string;
+        reviewedVersion?: string;
+        reviewedCommit?: string;
         reviewer: string;
         reviewCommit: string;
         notes: string;
     };
     catalog?: CatalogSection;
+    /** Where the entry installs from. */
+    source: 'npm' | 'github';
+    /** `owner/slug`; present exactly when `source` is github. */
+    repo?: string;
 }
 export interface DeniedEntry {
     name: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-shop",
-  "version": "0.4.8",
+  "version": "0.4.10",
   "description": "The DeepSeek Harness plugin shop: browse, install, enable, and update dsh plugins from a git-auditable catalog.",
   "repository": {
     "type": "git",